In an era where generative image systems can produce realistic visuals at scale, verifying the origin and authorship of AI-generated content has become increasingly challenging. A research team has introduced Latent Seal, a watermarking framework that embeds robust watermarks during the image generation process itself, rather than as a post-processing step. This approach aims to support copyright protection and content tracing while maintaining high image quality.
The framework, developed by researchers from Macao Polytechnic University, Guangdong University of Technology, Jinan University, and the Institute of Automation, Chinese Academy of Sciences, was detailed in a study published in Machine Intelligence Research (DOI: 10.1007/s11633-025-1620-y). Latent Seal operates by embedding a customized image watermark into the latent space of latent diffusion models (LDMs) during generation. A paired decoder then recovers the mark from protected images, enabling both detection of AI-generated content and verification of copyright.
Traditional post-processing watermarks are easy to deploy but remain separate from the model and can be removed or bypassed. In-generation techniques, while more integrated, often carry limited information or fail under common distortions. Latent Seal addresses these issues by using a latent-space encoder that blends an RGB watermark into the model's internal representation, with a decoder that recovers the mark only from protected images. This design ensures that the watermark is deeply embedded and resilient to real-world manipulations.
In testing, the team built the system around Stable Diffusion 2.1 and used a dataset of 74,247 generated images, with 69,247 for training and 5,000 for testing. The system freezes the denoising network, clones and fine-tunes the variational autoencoder (VAE) decoder, and inserts the watermark encoder into an intermediate decoding block. The decoder is trained to recover the watermark from protected images and output a blank for unprotected ones, reducing false detections.
The results showed that watermarked images achieved a peak signal-to-noise ratio of 44.29 dB and a structural similarity index of 0.9933, while recovered watermarks reached 39.19 dB, 0.9971 SSIM, and 0.9992 normalized cross-correlation. Latent Seal retained the strongest extraction quality across all tested attacks—including brightness, contrast, saturation changes, blur, noise, compression, flips, cropping, and rotation—and added only 7.33 milliseconds during embedding and 2.26 milliseconds during extraction. Tests on Stable Diffusion XL and 3.5 also showed consistent performance across models and resolutions.
The authors emphasized that the goal is to integrate provenance protection into image creation, not as an afterthought. "The aim is to preserve the visual quality users expect while giving model providers a practical way to verify origin after images have been edited or shared," they said. "Our results suggest that strong watermark recovery and low visual impact can be achieved together. The next step is to improve recovery for visually complex watermarks and make the framework adaptable to new watermark designs without retraining the full system each time."
Latent Seal could support provenance checks for commercial image generators, social-media investigations, copyright disputes, content moderation, and digital-asset management. Its ability to carry a full-color image offers more identifying capacity than simple binary signatures, and its resistance to routine edits helps marks survive online sharing. However, the current system must be retrained for each new watermark, and recovery accuracy decreases with more complex watermark textures and colors. The researchers propose frequency-domain feature fusion and a lightweight adapter for arbitrary watermarks as future directions. In practice, the method works best alongside disclosure policies, metadata standards, and other content-authentication tools.
